docs: update FUTURE.md, HISTORY.md, DEVELOPMENT_LOG.md for v0.20.2

DEVELOPMENT_LOG.md

@@ -6,6 +6,46 @@
 
 ---
 
+### v0.20.2 — Transaction Wrapping for Migrations
+**Status:** ✅ COMPLETED  
+**Date:** 2026-05-10  
+**Priority:** CRITICAL
+
+| Agent | Status | Time | Notes |
+|-------|--------|------|-------|
+| Neo | ✅ COMPLETED | 9m | Implemented transaction wrapping for all migrations |
+| Bishop | ✅ COMPLETED | 2m | Verified Docker build, migrations, login, version bump |
+| Hudson | ✅ COMPLETED | 31s | Security audit: 6/7 PASS, 1 FAIL (FK re-enable) — Ripley fixed |
+| Ripley | ✅ COMPLETED | — | Fixed v0.40 FK issue, committed, pushed, deployed |
+
+**Files modified:** `db/database.js`, `client/lib/version.js`, `package.json`, `FUTURE.md`, `HISTORY.md`
+
+**Task ID:** migration-transactions-002
+
+**Objective:**
+Wrap all database migrations in BEGIN/COMMIT/ROLLBACK transactions so partial failures don't leave the schema in an inconsistent state.
+
+**Work Completed:**
+- [x] Wrapped versioned migrations loop in BEGIN/COMMIT/ROLLBACK
+- [x] Wrapped legacy reconciliation migrations in BEGIN/COMMIT/ROLLBACK
+- [x] Wrapped unversioned user notification columns in BEGIN/COMMIT/ROLLBACK
+- [x] Special handling for v0.40 PRAGMA foreign_keys (OFF before BEGIN, ON in finally block)
+- [x] Fixed Hudson finding: FK re-enable now uses try/finally to guarantee restoration even on error
+- [x] Hudson security audit: 6/7 PASS, 1 FAIL → fixed → all clear
+- [x] Docker build + fresh DB test: all migrations apply correctly with transaction logging
+- [x] Version bumped to 0.20.2
+
+**Security Audit (Hudson):**
+1. Transaction atomicity: ✅ PASS
+2. PRAGMA foreign_keys handling: ❌ FAIL → ✅ FIXED (try/finally)
+3. SQLite WAL mode: ✅ PASS
+4. Error propagation: ✅ PASS
+5. recordMigration inside transaction: ✅ PASS
+6. SQL injection: ✅ PASS
+7. Concurrent access: ✅ PASS
+
+---
+
 ## Current Work (In Progress)
 
 ### v0.20.1 — Code Splitting + Admin Dashboard + Version Bump